컨테이너 런타임의 보안성 측정 기법
Security Assessment Technique of a Container Runtime Using System Call Weights
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
본 연구에서는 보안 컨테이너 런타임 간의 직접적인 보안성 비교를 가능하게 하는 정량 평가기법을 제안한다. 보안 컨테이너 런타임(Security Container Runtime) 기술들은 컨테이너가 호스트커널을 공유하여 발생하는 컨테이너 탈출(Container escape)과 같은 보안 이슈를 해결하기 위하여등장하였다. 하지만 대부분의 문헌들에서 컨테이너 기술들의 보안성에 대하여 사용 가능한 시스템 콜 개수와 같은 대략적인 지표를 이용한 분석만을 제공하고 있어서 각 런타임에 대한 정량적인 비교 평가가 힘든 실정이다. 반면에 제안 모델은 호스트 시스템 콜의 노출 정도를 다양한 외부 취약점 지표들과 결합하는 새로운 방식을 사용한다. 제안하는 기법으로 runC(도커 기본 런타임) 및 대표적인 보안 컨테이너 런타임인 gVisor, Kata container의 보안성을 측정하고 비교한다.
Abstract
In this paper, we propose quantitative evaluation method that enable security comparison between Security Container Runtimes. security container runtime technologies have been developed to address security issues such as Container escape caused by containers sharing the host kernel. However, most literature provides only a analysis of the security of container technologies using rough metrics such as the number of available system calls, making it difficult to compare the secureness of container runtimes quantitatively. While the proposed model uses a new method of combining the degree of exposure of host system calls with various external vulnerability metrics. With the proposed technique, we measure and compare the security of runC (Docker default Runtime) and two representative Security Container Runtimes, gVisor, and Kata container.
참고문헌 (23)
- Z. Jian, "A Defense Method against Docker Escape Attack", Proceedings of the 2017 International Conference on Cryptography, Security and Privacy (ICCSP’17), pp.142~146 (2017)
- Sari Sultan, "Container Security: Issues, Challenges, and the Road Ahead", IEEE Access, 7, pp.52976~52996 (2019), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- "GVisor"[URL]
- "Kata container"[URL]
- "Nabla container"[URL]
- Ethan G. Young, "The True Cost of Containing: A gVisor Case Study", Proceedings of the 11th USENIX Conference on Hot Topics in Cloud Computing(HotCloud’19), pp.16~ (2019)
- Anjali, Tyler Caraza-Harter, "Blending containers and virtual machines: a study of firecracker and gVisor", Proceedings of the 16th ACM SIGPLAN, 2020, 101~113
- "Measuring the Horizontal Attack Profile of Nabla Containers"[URL]
- "CVE"[URL]
- D. Williams, "Unikernels As Processes", Proceedings of the ACM Symposium on Cloud Computing, SoCC ’18, pp.199~211 (2018)
- A. Kurmus, "Attack Surface Metrics and Automated Compile-Time OS Kernel Tailoring", Proceedings of the 20th Network and Distributed System Security Symposium(NDSS’13) (2013)
- Y. Li, "Lock-in-Pop:Securing Privileged Operating System Kernels by Keeping on the Beaten Path", Proceedings of In Annual Technical Conference USENIX ATC’17, pp.1~13 (2017)
- D. Williams, "Say goodbye to virtualization for a safer cloud", Proc. of USENIX HotCloud, pp.20~ (2018)
- A. Agache, "Firecracker: Lightweight virtualization for serverless applications", 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20), pp.419~434 (2020)
- "ExploitDB"[URL]
- "CVSS v2 Calculator"[URL]
- T.J. McCabe, "A Complexity Measure", IEEE Transactions on Software Engineering, SE-2(4), pp.308~320 (1976), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- "Objdump man page"[URL]
- "LTP Project"[URL]
- "Ftrace man page"[URL]
- "Docker Seccomp Profile"[URL]
- "GVisor Seccomp Rule"[URL]
- A. Randazzo, "Kata Containers: An Emerging Architecture for Enabling MEC Services in Fast and Secure Way", Proceedings of the 2019 Sixth International Conference on Internet of Things: Systems, Management and Security (IOTSMS 2019), pp.209~214 (2019)